AC 120-28D Appendix 3 07/13/99 A common set of ARM and ACTIVE mode indications (e.g., LOC and GS) is preferred for ILS, MLS and GLS operations;
A means must be provided for the crew to determine a failure of the non-selected navigation receiver function, in addition to the selected navigation receiver function. When considering equipment failures, the failure indications must not mislead through incorrect association with navigation source. For example, it would not be acceptable for the annunciation "ILS FAIL" to be displayed when the selected navigation source is MLS and the failure actually affects the MLS receiver;
6.9.4. Alerting. Flight operations may require planning to alternate destination runways or alternate airports for takeoff, en route diversion and landing. Various runways at these airports may have different landing systems. Thus, flight operations may be planned, released and conducted on the basis of using one or more landing systems.
Accordingly, the ability to determine the capability of each element of a multi-mode landing system should be available to the flightcrew to support flight planning.
A failure of a non-selected landing mode (i.e., ILS, MLS, GLS) shall be indicated to the flightcrew as an advisory if it has been determined that the mode is not available or will not be available for use during the next approach and landing.
A failure of the active element of a multi-mode landing system during an approach shall be accompanied by a warning, caution, or advisory, as appropriate.
An indication of a failure in each non-selected element a multi-mode landing system shall be available to the flightcrew as an advisory but should not produce a caution or warning. Such advisories may be inhibited during takeoff, below Alert Height, and at other times as determined necessary or appropriate for the alerting system and flight deck design philosophy of the aircraft type.
7. Landing and Rollout System Evaluation. An evaluation should be conducted to verify that the pertinent systems as installed in the airplane meet the airworthiness requirements of section 6 of this appendix. The evaluation should include verification of landing and rollout system performance requirements and a safety assessment for verification of the integrity and availability requirements.
Engine failure cases and other selected failure conditions identified by the safety assessment should be demonstrated by simulator and /or flight tests.
An applicant shall provide a certification plan which describes:
a) The means proposed to show compliance with the requirements of section 6 of this appendix, with particular attention to methods which differ significantly from those described in this appendix.
b) How any non-airplane elements of the Landing and Rollout System relate to the airplane system from a performance, integrity and availability perspective.
c) The assumptions on how the performance, integrity and availability requirements of the nonairplane elements will be ensured.
d) The system concepts and operational philosophy to allow the regulatory authority to determine whether criteria and requirements in excess of that contained in this appendix are necessary.
AC 120-28D 07/13/99 Appendix 3 Early agreement between the applicant and the FAA should be reached on the proposed certification plan. Upon completion of an FAA engineering design review and supporting simulation studies, a type inspection authorization (TIA) should be issued to determine if the complete installation of the equipment associated with Category III operations meets the criteria of this appendix.
7.1. Performance Evaluation. The performance of the airplane and its systems must be demonstrated by either flight test or by analysis and simulator tests supported by flight test. Flight testing must include a sufficient number of normal and non-normal approaches conducted in conditions which are reasonably representative of actual expected conditions and must cover the range of parameters affecting the behavior of the airplane (e.g., wind speed, NAVAID (e.g., ILS) characteristics, airplane configurations, weight, center of gravity, non-normal events).
The performance evaluation must verify that the Landing and Rollout System meets the performance requirements of sections 6.1, 6.2, and 6.3 and sub-sections of this appendix. The tests must cover the range of parameters affecting the behavior of the airplane (e.g., airplane configurations, weight, center of gravity, non-normal events) when the airplane encounters the winds described by either of the models in Appendix 4, or other model found acceptable by the Administrator, and the variations in flight path determination associated with the sensors used by the Landing and Rollout system. Flight testing must include a sufficient number of normal and non-normal approaches conducted in conditions which are reasonably representative of actual expected conditions.
The reference speed used as the basis for certification should be identified. The applicant should demonstrate acceptable performance within a speed range of -5 to +10 knots with respect to the reference speed, unless otherwise agreed by the FAA and the applicant. The reference speed used as the basis for certification should be the same as the speed used for normal landing operations, including wind and other environmental conditions.
The applicant shall demonstrate that the landing and rollout system does not exhibit any guidance system or control characteristics during the transition to rollout which would cause the flightcrew to react in an inappropriate manner (e.g., during nose wheel touch down, spoiler extension, initiation of reverse thrust).
Landing systems for manual control with guidance must meet the same requirements for touch down footprints, sink rates and attitude as automatic landing systems.
The landing and rollout system shall be shown to be satisfactory with and without the use of any outside visual references, except that outside visual references will not be considered in assessing path tracking and touch down performance. The airworthiness evaluation will also determine whether the combination of guidance and outside visual references would unacceptably degrade task performance, require excessive pilot compensation or workload during normal and non-normal operations.
For the purpose of the airworthiness demonstration, the operational concept for coping with the loss of guidance may assume the presence of adequate outside visual references for the flightcrew to safely continue the operation. The airworthiness demonstration should include the loss of guidance to show there are otherwise no adverse system effects.
For rollout systems for manual rollout with guidance, it shall be demonstrated that a safe rollout can be achieved with a Satisfactory level of workload and pilot compensation following a failure. Workload and task compensation may be assessed using the FAA Handling Quality Rating System (HQRS) found in AC 25-7A, as amended, or equivalent, with and without external visual reference. Rollout guidance must be demonstrated without external visual reference to show that a pilot can satisfactorily perform the
AC 120-28D Appendix 3 07/13/99 lateral tracking task with the guidance alone. Rollout guidance must also be demonstrated with external visual reference to show that the combination of guidance and visual reference is compatible and does not unacceptably degrade task performance, require excessive pilot compensation or workload during normal and non-normal operations.
For the evaluation of low visibility systems for manual control with guidance for landing or rollout, the set of subject pilots provided by the applicant should have relevant variability of experience (e.g., experience with or without HUD, Captain or First Officer (F/O) crew position experience as applicable, and experience in type). Subject pilots must not typically have special experience that invalidates the test (e.g., pilot's should not have special recent training to cope with HUD failures, beyond that which a line pilot would be expected to have for routine operation). The set of pilots provided by the certifying authorities may have experience as specified by the authority appropriate to the test(s) to be conducted. The experience noted above for authority subject pilots or evaluation pilots may or may not be applicable or appropriate for the tests to be conducted.
Failure cases should typically be spontaneous and unpredictable on the subject's or evaluation pilot's part.
For the initial certification of a landing and rollout system for manual control with guidance (e.g., HUD guidance system) in a new type airplane or new type HUD installation, at least 1,000 simulated landings and at least 100 actual aircraft landings is typically necessary. For evaluation of these systems, individual pilot performance should also be considered as a variable affecting performance, see section 6.3.4. As described in the paragraph above, subject pilots of varying background and experience level should be used in the flight and simulation programs. Subject pilots should have appropriate qualifications and, when applicable, be trained in the use of the landing system in a manner equivalent to that expected for pilots who will use the system in operational service.
For data collection tests, after a significant number of consecutive approaches (e.g., 10 approaches), subject pilots should be afforded the opportunity for an appropriate rest break.
7.1.1. High Altitude Automatic Landing System Demonstration.
The following describes an acceptable means to demonstrate performance of automatic landing systems at high altitude with a combination of flight test results and validated simulation. The airport elevation at which satisfactory performance of an automatic landing system has been demonstrated by this method, may then be documented in the Airplane Flight Manual (AFM). The flight test demonstration is considered the primary source of data, which can then be supplemented with data from a validated simulation.
The minimum required altitude or elevation for the flight test which is used to demonstrate a desired AFM Elevation Value, by this method, is shown in Figure 7.1.1-1 and the accompanying table, below.
For example, the applicant may document an AFM Elevation Value of 8,000 ft., by a successful flight demonstration at 8,000 ft., or by a flight demonstration at a minimum elevation of 5,000 ft. with a simulation to the desired 8,000 ft. Note, the lines in Figure 7.1.1-1 converge at 11,000 ft, which indicates that credit for simulation is not available at 11,000 ft or above.
The atmospheric temperature and pressure during the flight test, for either method, should not be more favorable than International Standard Atmosphere (ISA) conditions, to ensure that the density altitude is not less than the airport elevation. When the density altitude value of the flight test is less than the airport elevation, then the density altitude value should be used as the effective Flight Test Demonstrated Elevation, and this will decrease the maximum AFM Elevation Value.
AC 120-28D 07/13/99 Appendix 3 Assuring acceptable autoland performance at high altitude by using a flight test validated simulation requires a sufficient quantity of flight test data. Flight test data should be obtained from approximately 10-15 landings at a Flight Test Demonstrated Elevation shown in Figure 7.1.1-1. For flight validation, the test airplane should be equipped with instrumentation to measure and record:
1) The airplane's trajectory, using an acceptably accurate method, such as by a differential global positioning system (DGPS) receiver, a laser optical tracker, a calibrated camera, or other equivalent method.
2) Touchdown vertical velocity and runway touchdown point, expressed in suitable units and coordinates.
3) Glideslope and Localizer signal deviations.
4) Airplane state parameters as necessary, including relevant powerplant and flight control, information.
5) Relevant Autopilot, autothrottle, and/or HUD guidance system parameters and performance.
6) Atmospheric conditions at the airport at the time of each approach, including temperature, barometric pressure (QNH), mean wind velocity and direction.
The simulation should be validated through comparison of simulation data with quantitative flight test measurements. Time histories of the airplane and systems performance in the approach, flare, touchdown, rollout and go-around flight phases, for flight tests at the Flight Test Demonstration Elevation should be compared with corresponding simulation results. The comparison between the flight test data and the simulation data should show that the two are consistent at corresponding altitudes.
Acceptable autoland performance at the selected AFM Elevation may then be based on validated simulation results, within the acceptable extrapolation range for flight test data shown in Figure 7.1.1-1.
To assure acceptable autoland performance in a range of altitudes and atmospheric conditions up to and including the selected AFM Elevation, the simulation should include variation in atmospheric conditions at least as listed below. A sensitivity analysis should be conducted to assure that performance is not unsafe near any limits.
Unless otherwise found acceptable to the FAA, simulation cases should typically include the following:
a) Temperatures ranging from International Standard Atmosphere (ISA) value to ISA +40C.
b) Barometric pressure ranging from ISA value for that elevation to ISA -50 hPa.
c) Mean wind variations, including:
- headwinds to at least 25 knots
- crosswinds to at least 15 knots
- tailwinds to at least 10 knots
AC 120-28D Appendix 3 07/13/99 0 2000 4000 6000 8000 10000 12000 14000 0 2000 4000 6000 8000 10000 12000 14000 Flight Test Demonstrated Elevation AFM Elevation Value AFM Elevation Value Flight Test Demonstrated Elevation FIGURE 7.1.1-1: AFM ELEVATION VALUE FROM FLIGHT TEST AND VALIDATED SIMULATION TABLE 7.1.1-1: EXAMPLE AFM ELEVATION VALUES Flight Test Demonstration Airport Elevation (feet above mean sea level) Airport Elevation Value Which May Be Listed in the AFM (feet above mean sea level) 1,000 6,000 2,000 6,500 3,000 7,000 5,000 8,000 7,000 9,000 9,000 10,000 11,000 11,000
7.1.2. Validation of Simulators for Pilot-in-the-Loop Systems. The certification process for a "Pilotin-the-Loop" system intended for Category III typically requires use of a high fidelity, engineering quality simulation.
Advisory Circular (AC) 120-40B (7/29/91) Airplane Simulator Qualification, as amended, provides a means to qualify simulators for qualification of pilots. Meeting these requirements provides a known basis for acceptance of simulation capability, and is desirable, but may not necessarily be sufficient to meet the requirements of an engineering simulation to demonstrate landing system performance.
AC 120-28D 07/13/99 Appendix 3 Training simulators may not have suitable fidelity in each relevant area, and may not be acceptable for use without modification. For purposes of system airworthiness demonstration, meeting the requirements of AC 120-40B is optional. Meeting the criteria of this AC provides an acceptable basis for establishing certification simulation capability.
When simulation is used for demonstration of manual "pilot-in-the-loop" systems with guidance, suitable simulation fidelity should be addressed for at least each critical characteristic affecting the validity of the simulation. An acceptable simulation should typically be capable of varying one parameter at a time, and be able to facilitate examination of the effects of specific wind, wind gradient, and turbulence conditions on approach and landing performance.
Factors of the simulation to be considered include the following:
• Guidance and control system interfaces
• motion base suitability
• "ground effect" aerodynamic characteristics
• wind/turbulence model suitability and adequacy of interface with the simulation
• suitability of landing gear and ground handling dynamics
• adequacy of stability derivative estimates used
• adequacy of any simplification assumptions used for the equations of motion;
• fidelity of flight controls and consequent simulated aircraft response to control inputs
• fidelity of the simulation of aircraft performance
• suitability of the simulation for alignment, flare, and rollout control tasks for any normal or nonnormal configurations or disturbance conditions to be assessed
• adequacy of flight deck instruments and displays
• adequacy of simulator and display transient response to disturbances or failures (e.g., engine failure, autofeather, electrical bus switching)
• visual reference availability, fidelity, and delays
• suitability of visibility restriction models such as appropriate calibration of visual references for the tests to be performed for day, night, and dusk conditions as necessary
• ability to simulate flight deck visual cutoff angles
• ability to simulate fog, rain, snow or patchy or intermittent conditions or external visual runway, lighting, marking or nearby terrain scenes as necessary, or
• fidelity of any other significant factor or limitation relevant to the validity of the simulation.
AC 120-28D Appendix 3 07/13/99 For airworthiness certification credit, a review of the simulation, on a case by case basis, must address at least the following factors:
1) Simulation fidelity relevant to landing system assessment,
2) Stability derivatives, equation of motion assumptions, and relevant ground effect and air and ground dynamic models used,
3) Adequacy of the source of aerodynamic performance and handling quality data used,
4) Visual system fidelity and configuration,
5) Environmental models and methods of model input to the equations of motion, including suitable incorporation of altitude and atmospheric temperature effects,
6) Adequacy of adverse weather models (e.g., visual reference models, runway friction), and
7) Adequacy of irregular terrain models.
A suitably high degree of fidelity is required in each relevant component part of the simulation including:
longitudinal, lateral and directional stability (static and dynamic), ground effect during takeoff or landing as applicable, rollout dynamic characteristics, propulsion system characteristics, (especially for turbopropeller aircraft which have may have significant lift from thrust effects, and drag transient effects due to engine failure), flying qualities, display or visual system capability as it affects tracking tasks, force characteristics of flight controls (e.g., yoke/wheel, rudder, brakes), and performance of the airplane. The fidelity of the simulator may be demonstrated using matching time histories and ensemble touchdown footprint correlation obtained from flight test. The data provided to validate the simulation and the simulation data, itself, will be included as part of the type certification data package.
7.1.3. Simulations for Automatic System Performance Demonstration.
The certification process for systems intended for assessment of automatic systems for Category III operations (e.g., automatic landing systems, automatic landing and rollout systems) typically require the use of a high fidelity "fast-time" simulation.
For airworthiness certification credit, a review of the simulation, on a case by case basis, must address at least the following factors:
1) Simulation fidelity relevant to landing system assessment,
2) Stability derivatives, equation of motion assumptions, and relevant ground effect and air and ground dynamic models used,
3) Adequacy of the source of aerodynamic performance and handling quality data used,
4) Disturbance input method(s) and fidelity,
5) Environmental models and methods of model input to the equations of motion, including suitable incorporation of altitude and atmospheric temperature effects,
AC 120-28D 07/13/99 Appendix 3
6) Adverse weather models (e.g., turbulence, wind gradients, wind models), and
7) Adequacy of irregular terrain models.
Fidelity of the aerodynamic model is needed for at least ground effect, propulsion effects, touch down dynamics, de-rotation, and landing gear models if required for ground rollout characteristics. The fidelity of the simulator may be demonstrated using matching time histories obtained from flight test. The data provided to validate the simulation and the simulation data, itself, will be included as part of the type certification data package.
7.1.4. Flight Test Performance Demonstration. A flight test performance demonstration should be conducted, in part, to confirm the results of simulation. A test airplane equipped with special instrumentation can be used to record the necessary flight test data, for subsequent correlation of flight test results with simulation results. Comparisons should address flight test data, "Monte Carlo simulation" results, and failure demonstration simulation results.
The principal performance parameters to be addressed include, as applicable: vertical and lateral flight path tracking with respect to the intended path (e.g., localizer error, glideslope error, lateral deviation from runway centerline during rollout); altitude and height above terrain during approach or the runway;
air data vertical speed and radar altitude sink rate; airspeed and ground speed; and longitudinal and lateral runway touchdown point.
Instrumentation capable of appropriate sample rates and scaling should be used to record relevant parameters (as a function of time, when applicable) including: air data parameters (e.g., airspeed, angle of attack, temperature); aircraft position; attitude; heading; track; velocity and velocity errors (e.g., ground speed, speed error), relevant accelerations; pilot control inputs and resulting surface positions, command information (i.e., flight director), sink rate at touch down (for structural limit load); drift angle at touch down (for gear/tire load); applicable mode and mode transition information (e.g., flare, autothrottle retard, rollout engage); wind as measured at the airplane; a method to determine any unusual aircraft contact with the runway (e.g., wing, nacelle or tail skid ground contact); and reported surface winds and gusts near the runway, at the time of approach and landing.
Data taken during demonstration flight tests should be used to validate the simulation(s). Unless otherwise agreed by FAA, the objective of a flight test program should be to demonstrate performance of the system to 100% of the steady state wind limit values (e.g., typically at least a 25 kt headwind, 15 kt crosswind, and 10 kt tailwind) that are used in the simulation statistical performance analysis. The simulation can be considered validated if at least four landings are accomplished during flight test at no less than 80% of the intended limit steady state wind value, and a best effort has been made to achieve the full steady state wind component values. It must be shown that the landing system is sufficiently robust near the desired AFM wind demonstrated values.
7.1.5. Demonstration of Approach and Landing with an Inoperative Engine.
The applicant may optionally demonstrate the low visibility landing system with an inoperative engine, and, accordingly, the Airplane Flight Manual (AFM) may state what capability has been satisfactorily demonstrated. With the critical engine inoperative, the applicant may demonstrate the capability to “initiate” and complete the approach and landing. Alternatively, the applicant may demonstrate the capability to “continue” the approach and landing, following failure of the critical engine at any point above the Alert Height or Decision Height.
AC 120-28D Appendix 3 07/13/99 Provisions of section 5.17 of this AC apply to these demonstrations, as do provisions of this appendix related to landing and rollout performance. The applicant should identify the critical engine, if any, considering any steady state or transient effects on performance, handling, loss of systems, and landing mode status (e.g., alignment, flare, rollout). Individual engines may be critical for different reasons.
If the airplane configuration, procedures or operation are the same as that used in the performance demonstration of section 6.3.1 of this appendix for all-engine operation, compliance may be demonstrated by, typically, 10 to 15 landings. If there are differences in these airplane configurations, procedures or operations, the number of required landings will be determined by FAA, on a case by case basis.
If the airplane configuration, procedures or operation is changed significantly from the all-engine operating case, compliance must typically be demonstrated by statistical analysis of Monte-Carlo simulation results supported by flight test. Any effect on configuration or landing distance must be considered.
To aid planning for landing with an inoperative engine, or engine failure during approach or go-around, appropriate procedures, performance, and obstacle clearance information should be available to permit an operator to provide for a safe go-around at any point in the approach to touchdown. For the purposes of this requirement, demonstration or data regarding landing and go-around performance in the event of a second engine failure need not be considered.
If compliance for the case of initiation or continuation of an approach with engine failure is intended, a statement shall be included in the Non-normal Procedures, or equivalent section of the Flight Manual.
The flight manual should note that approach and landing with an engine inoperative has been satisfactorily demonstrated. The AFM should list the relevant configuration and conditions under which that demonstration was made (see Appendix 3 section 9, and Appendix 6, regarding sample AFM provisions).
7.2. Safety Assessment. In addition to any specific safety related criteria identified in this appendix, a safety assessment of the Landing and Rollout system, considered separately and in conjunction with other systems, shall be conducted to meet the requirements of section 25.1309.
The safety level for an automatic landing and rollout system, or manual landing and rollout system with command information as guidance, should not be less than that typically achieved during a conventional manual landing accomplished by a pilot using a combination of external visual reference and flight instruments. Hence, in showing compliance with the performance and failure requirements, the probabilities of performance or failure effects may not be factored by the proportion of landings made using the landing and roll out system.
In showing compliance with airplane system performance and failure requirements, the probabilities of performance or failure effects may also not be factored by the proportion of approaches which are made in low visibility conditions.
The effect of the failure of navigation facilities must be considered taking into account ICAO and other pertinent State criteria.
Documented conclusions of the safety analysis shall include:
a. A summary of results from the fault tree analysis, demonstrated compliance, and probability requirements for significant functional hazards.
AC 120-28D 07/13/99 Appendix 3
b. Information regarding "alleviating flightcrew actions" that were considered in the safety analysis.
This information should list appropriate alleviating actions, if any, and should be consistent with the validation conducted during testing. If alleviating actions are identified, the alleviating actions should be described in a form suitable to aid in developing, as applicable:
1) Pertinent provisions of the airplane flight manual procedures section(s), or
2) Flight Crew Operating Manual (FCOM) provisions, or equivalent, or
3) Pilot qualification criteria (e.g., training requirements, FSB provisions), or
4) Any other reference material necessary for an operator or flightcrew to safely use the system.
c. Information to support preparation of any maintenance procedures necessary for safety, such as:
1) Certification maintenance requirements (CMR),
2) Periodic checks, or
3) Other checks, as necessary (e.g., return to service).
d. Information applicable to limitations, as necessary.
e. Identification of applicable systems, modes or equipment necessary for use of the landing system, to aid in development of flight planning or dispatch criteria, or to aid in development of procedures or checklists for pilot selection of modes or assessment of system status, prior to initiation of approach or during approach.
f. Information necessary for development of Non-normal procedures.
8. AIRBORNE SYSTEMS. The airborne system should be shown to meet the performance, integrity and availability requirements identified in this AC, as applicable to the type(s) of operation(s) intended.
In addition, airborne systems intended for use for Category III approach and landing, or approach, landing and rollout shall comply with the pertinent sections of this appendix and the specific requirements which follow.
8.1. Automatic Flight Control Systems. When established on a final approach path below 1000 ft. HAT, it must not be possible to change the flight path of the airplane with the automatic pilot(s) engaged, except by initiating an automatic go-around.
It must be possible to disengage the automatic landing system at any time without the pilot being faced with significant out-of-trim forces that might lead to an unacceptable flight path disturbance.
It must be possible for each pilot to disengage the automatic landing system by applying a suitable force to the control column, wheel, or stick. This force should be high enough to preclude inadvertent disengagement, and low enough to be applied with one hand, but not as low as those described in section 25.143.
Following a failure or inadvertent disconnect of the automatic pilot, or loss of the automatic landing mode, when it is necessary for a pilot to immediately assume manual control, a visual alert and an aural warning must be given. This warning must be given without delay and be distinct from all other cockpit
AC 120-28D Appendix 3 07/13/99 warnings. Even when the automatic pilot is disengaged by a pilot, a warning must sound for a period long enough to ensure that it is heard and recognized by that pilot and by other flightcrew members. The warning should continue until silenced by one of the pilots using an automatic pilot quick release control, or is silenced by another acceptable means. For purposes of this provision, an automatic pilot quick release control must be mounted on each control wheel or control stick.
8.2 Autothrottle Systems. The following criteria apply to an autothrottle system when used with a low visibility landing system, if an autothrottle is provided.
a. An automatic landing system must include automatic control of throttles to touch down unless it can be shown that:
1) Airplane speed can be controlled manually without excessive workload, in representative conditions for which the system is intended and as demonstrated; and
2) For manual control of throttles, the touch down performance limits must be achieved both for normal autopilot operations and applicable non-normal operations (e.g., engine failure, as applicable;
during pilot takeover to manual control using HUD guidance, if part of a hybrid system).
b. An automatic throttle system must provide safe operation taking into account the factors listed in Appendix 3, section 7.1 Landing and Rollout Criteria. Additionally, the system should:
1) Adjust throttles to maintain airplane speed* within acceptable limits;
*NOTE: The approach speed may be selected manually or automatically. If automatically selected, each pilot must be able to determine that the aircraft is flying an appropriate speed.
2) Provide throttle application at a rate consistent with the recommendations of the appropriate engine and airframe manufacturers,
3) Modulate thrust or throttle application at a rate consistent with, and with activity consistent with typical pilot expectation, considering speed error to be corrected, and any particular conditions or circumstances (e.g., flare retard, go-around thrust application, response to wind gradients), and
4) Respect maximum limits, minimum limits, and any limits necessary for specific conditions
(e.g., anti-ice, approach idle).
c. An indication of pertinent automatic throttle system engagement must be provided.
d. An appropriate alert or warning of automatic throttle failure must be provided.
e. It must be possible for each pilot to override the automatic throttle (when provided) without using excessive force.
f. Automatic throttle disengagement switches must be mounted on or adjacent to the throttle levers where they can be operated without removing the hand from the throttles.
AC 120-28D 07/13/99 Appendix 3
g. Following a failure, failure disconnect, or inadvertent disconnect of the automatic throttle, or uncommanded loss of a selected automatic throttle mode, a suitably clear and compelling advisory or indication should be provided.
8.3. Head Up Guidance.
a. For a Head Up Guidance landing system, intended for manual "pilot-in-the-loop" control during a low visibility approach and landing, and if applicable, a low visibility rollout, the HUD must provide sufficient command information as guidance to enable the pilot to maintain the approach path, to make the alignment with the runway, flare and land the airplane within the prescribed limits. The HUD must also provide sufficient information to enable the pilot to initiate a go-around without reference to other cockpit displays.
b. HUD manual guidance must not require exceptional piloting skill to achieve the required performance.
c. The workload associated with use of the HUD must be considered in showing compliance with the minimum flightcrew requirements found in section 25.1523.
d. Any HUD installation, or HUD display presentation, to comply with FAR 25.773, must not significantly obscure or degrade the pilot's outside view or field of view, or other flightcrew member's outside view or field of view, through the cockpit window(s). For compliance with this provision, consideration should be given to dynamic and/or extreme ambient lighting conditions which can affect the brightness of the display in a manner that adversely affect the suitability of outside view through the HUD and cockpit windows. The outside view must also be adequate around the HUD combiner through cockpit windows (e.g., no significant HUD combiner or electronics unit blockage of pilot view).
e. Head Up Guidance systems may be considered Fail Passive if, after a failure, the airplane's flight path does not experience a significant, immediate deviation due to the pilot following the failed guidance, before detecting the failure and discontinuing its use.
f. The active mode of the HUD system itself, as well as the flight guidance/automatic flight control system, must be clearly annunciated in the HUD, unless there are compensating features for displaying them elsewhere.
g. If a manual "pilot-in-the-loop" landing and rollout system is designed to be used as a single HUD configuration, the HUD should be installed at the captain's crew station.
h. For a dual HUD configuration, unless otherwise approved by FAA, procedures should be based on the concept that the Pilot Flying (PF) is the pilot using the HUD during an approach. The Pilot Not Flying (PNF) is expected to monitor other pertinent flight deck indications (e.g., head down PFD, ND, thrust or engine parameters, systems, annunciations other than those provided on the HUD, and alerts).
While "head down" flight deck parameters may be assigned as a primary responsibility for a PNF, it is not necessary or expected that the PNF stow a PNF HUD. This provision does not preclude a PNF from referring to the HUD, or incorporating use of HUD information with outside visual reference, particularly when establishing or using outside visual reference. This provision also does not preclude other concepts for PF or PNF use of a dual HUD installation, if found acceptable by FAA.
i. If an automatic flight control system is used to control the flight path of the airplane prior to establishing manual "pilot-in-the-loop" HUD guidance on final approach (e.g., the autoflight system is